Conditional Access
Also known as: Conditional Access policies, Entra Conditional Access, Azure AD Conditional Access
Conditional Access is a security feature in Microsoft Entra ID that decides whether to allow a sign-in, require extra verification, or block it, based on conditions such as who the user is, which app they're opening, where they're signing in from, whether their device is managed, and how risky the sign-in looks.
For example, a policy might require MFA everywhere and block sign-ins from countries where the company doesn't operate. While Conditional Access is one of the most powerful protections for small businesses, a badly written policy can lock everyone out, including administrators.
Conditional Access, explained at three levels
At home
Conditional Access is like a security guard at an office door with a checklist. Before letting anyone in, the guard looks at who they are, where they came from and what they're carrying. Familiar staff on company laptops walk straight through, an unusual visit gets extra questions, and a stranger from abroad is turned away. Conditional Access asks those same questions at every sign-in.
At work
Conditional Access is a set of sign-in rules a business writes in Microsoft Entra ID. Each rule says, in effect, if this person, app, device or location, then allow, ask for MFA, or block. Because the rules run automatically on every sign-in, a stolen password used from an unknown laptop or another country can be stopped before it reaches company email or files.
At home
Conditional Access works like a set of if-then rules applied at every sign-in. Entra ID first looks at the situation: who is signing in, which app they want, what device they are using, where they are and how risky the attempt looks. Then it checks the organization's rules. If a rule says 'if this app, then require MFA' or 'if this country, then block', it applies. That is why your work account may ask for extra proof when you travel or refuse your personal laptop.
At work
Each policy has assignments, which define users, apps and conditions such as location, device platform and sign-in risk, and access controls, which grant access with requirements such as MFA, a compliant or hybrid-joined device, approved apps, or block access. Session controls can limit sign-in frequency or force app-enforced restrictions. Policies combine, and all applicable requirements must be met. Conditional Access requires Entra ID P1, included in Microsoft 365 Business Premium.
At home
Some organizations allow work email only on phones enrolled in management, or only through the Outlook app. A Conditional Access policy enforces that by checking the device or app before giving access. In return, the organization can require a passcode and remove company data if the phone is lost, often without touching your personal photos or apps. In my view, that is a fair trade for keeping company data off unprotected devices.
At work
Build policies from Microsoft's templates, and test each in report-only mode, using sign-in logs and the What If tool, before enforcing. Exclude break-glass accounts from every policy, document each policy's purpose, and use consistent naming. Require phishing-resistant MFA for admin roles through authentication strengths, block legacy authentication and device code flow where unused, and look for gaps such as service accounts, guest users and apps that fall outside policy scope.
Real-world examples
At home
Thomas tried to check work email from a hotel computer abroad. Conditional Access blocked it because the device wasn't managed by his company.
At work
Aisha manages IT for a Vancouver law firm. Her Conditional Access policies require MFA and company devices for client files, which stopped a phished password from being used.
How it compares
| feature | Conditional Access | Security defaults |
|---|---|---|
| Licence needed | Entra ID P1 or higher | Free |
| Customization | Highly flexible rules | Fixed settings |
| Device checks | Yes | No |
| Best for | Businesses with Business Premium | Very small or basic setups |
Security defaults are a good start. Conditional Access is the full toolkit.
For analysts
I'd document Conditional Access policies in plain language for leadership. Explaining 'who can sign in from where' builds support for security controls.
History & origin
Microsoft introduced Conditional Access in Azure Active Directory in the mid-2010s as cloud apps replaced office networks as the main security boundary. It became a core part of Microsoft's zero trust approach. For smaller organizations without premium licences, Microsoft introduced 'security defaults' in 2019, a simpler set of built-in protections. Starting in late 2023, Microsoft began automatically creating Microsoft-managed Conditional Access policies in many tenants, and from 2024 it enforced mandatory MFA for access to Azure and admin portals. In my view, Conditional Access is the best-value feature in Microsoft 365 Business Premium.